A municipal utility's control test fails because server hardening drifted from the approved baseline. How should Policy and Compliance coordinate with ITSM without turning CIS-RC into a Change Management exam?
Select an answer to reveal the explanation.
Short Explanation
Failed control, drifted config — treat it like a broken fence that needs a work order, not a memo. Kick a change from the failed control so IT actually remediates the drift.
Full Explanation
When a municipal utility control test fails because server hardening drifted from baseline, Policy and Compliance should open a change request from the failed control so configuration drift is remediated through the ITSM change process. That handoff keeps CIS-RC focused on compliance issue and evidence while Change Management owns the technical fix for infrastructure that supports public utility services. Opening only a knowledge article and waiting for the next annual test fails by concept because documentation without a work order does not restore the baseline. Creating a security incident playbook in SIR and ignoring the compliance issue fails by concept because SIR playbooks address security response patterns; they do not replace the compliance issue lifecycle or prove control remediation. Closing the control as effective because drift is only an operations problem fails by concept because control effectiveness depends on the operating configuration remaining compliant. Exam caveat: CIS-RC coordinates with ITSM change for remediation of failed technical controls without converting the item into pure Change Management trivia. Operational check: from a failed hardening control test, open or link a change request, complete remediation, retest, and confirm the compliance issue closes with change and retest evidence attached.